Cloud Compliance in India, Without the Audit Scramble

Yes. DPDPA applies based on whose data you process, not where your infrastructure sits. If you process the digital personal data of any Indian resident - including a customer, employee, or website visitor - you're a data fiduciary under DPDPA Section 3, regardless of where your cloud is hosted.

Cross-border transfers are permitted unless the Government notifies a country as restricted. As of April 2026, no countries have been notified as restricted, so Singapore-hosted SaaS remains compliant, provided you meet Rule 6 security safeguards and Rule 7 breach notification obligations.

At minimum, three:

• RBI Master Direction on IT Governance, 2023 - applies to NBFCs in the Middle, Upper, and Top Layers from 1 April 2024.
• RBI Master Direction on Outsourcing of IT Services, 2023 - applies to every regulated entity using cloud vendors, regardless of NBFC layer.
• CERT-In Directions under §70B - apply to every entity in India.

If you're a payment aggregator, PPI issuer, or BBPS participant, also add the RBI Cyber Resilience for Non-bank PSOs, 2024. If you're cards-touching, PCI DSS becomes a contractual requirement from your acquirer.

A Significant Data Fiduciary (SDF) is a data fiduciary that the Central Government has notified as significant - typically based on the volume and sensitivity of personal data processed, risk to electoral democracy, sovereignty, or public order. SDFs face additional obligations:

• Appoint a Data Protection Officer based in India
• Conduct periodic Data Protection Impact Assessments
• Undertake periodic audits by an independent auditor

Likely SDF candidates: large banks, insurers, telcos, e-commerce platforms, social media intermediaries, ed-tech, ride-hailing platforms. The first SDF notifications are expected in Q3 2026.

Yes, under SEBI LODR Regulation 30A. Listed companies must disclose material cyber incidents to stock exchanges within 24 hours of awareness. The new Schedule III lists cyber incidents as a deemed material event when they materially affect the company's operations, financials, or reputation.

This is in addition to CERT-In's 6-hour reporting (which is regulator-only) and DPDPA's 72-hour Data Protection Board notification. So a listed bank suffering a cloud breach has three parallel reporting clocks running.

Yes. The CERT-In Directions of April 2022 apply to "service providers, intermediaries, data centres, body corporate and Government organisations." A SaaS company headquartered in India or serving Indian users falls within scope.

You're required to report within 6 hours of becoming aware of any of 21 listed incident categories — including unauthorised access, data breaches, ransomware, identity theft, malicious code, and denial of service. The clock starts on awareness, not on confirmation.

Yes. AWS, Azure, and GCP are all in production at major Indian banks, NBFCs, and PSOs. RBI doesn't require Indian-owned cloud, but it does require:

• Indian regions for the data (most regulated workloads run in ap-south-1 Mumbai or ap-south-2 Hyderabad)
• A Master Outsourcing Agreement that meets RBI MD.OSP, 2023 requirements
• Documented exit strategy and material outsourcing register
• Right-to-audit clauses extending to RBI

The CSP being foreign-owned isn't the constraint. The contract, the data residency, and the operational governance are.

Indian courts and the Data Protection Board treat ISO/IEC 27001:2022 certification as the de facto evidence of reasonable security practice. The original §43A rules of 2011 named ISO 27001 explicitly; while DPDPA supersedes the 2011 SPDI Rules, the underlying judicial preference for ISO has carried forward.

In practice, "reasonable security" is evidenced through:

• ISO 27001:2022 certification or documented equivalence
• Continuous CSPM/CIEM/DSPM evidence across cloud workloads
• Regular VAPT and penetration test reports
• Incident response playbooks and tested recovery procedures
• Board-approved cyber security policy

The longest retention obligation wins - practically, you set your default at the maximum:

• RBI MD.ITG, 2023 · 5 years for banking workloads
• SEBI CSCRF, 2024 · 5 years for capital market entities
• IRDAI Guidelines (2025 amendment) · 180 days minimum for security event logs
• CERT-In §70B · 180 days, accessible to CERT-In on demand
• PCI DSS 4.0.1 · 1 year retained, 3 months immediately accessible
• DPDPA Rule 7 · variable, tied to the breach notification trail

Most regulated entities standardise on 5 years retained, 90 days hot, with WORM storage for the cold tier.

The statutory audits are separate — RBI's IT inspection, SEBI's CSCRF audit, the ISO 27001 surveillance audit, and DPDPA's SDF audit are all distinct exercises with different auditors and reporting templates.

But the underlying control evidence overlaps by ~80%. A single ion finding, screenshot, or log excerpt for "MFA on privileged access" is admissible across all four. The smart play is to maintain one continuous evidence layer, then filter and format for each auditor.

Each CSP is a separate "material outsourcing arrangement" under RBI MD.OSP, 2023. For each, you need:

• Board-approved outsourcing decision
• Risk assessment and due diligence dossier
• Master Outsourcing Agreement with mandated clauses
• Entry in your Material Outsourcing Register
• Documented exit strategy with realistic timelines
• Concentration risk assessment if any single CSP holds >30% of cloud workload

Multi-cloud doesn't reduce compliance burden, it multiplies it. But it does reduce concentration risk, which RBI views favourably.

ion produces three audit-grade artifact types:

• Control posture snapshots - point-in-time CSPM/CIEM/KSPM evaluations against named framework clauses, exportable as PDF or CSV with full clause references
• Continuous evidence trails - change-by-change configuration drift logs with timestamps, identity attribution, and clause mapping
• Incident timelines - 6-hour-ready CERT-In reports, DPDPA breach notifications, and SEBI material event filings auto-populated from runtime detection data

Big 4 auditors, RBI inspection teams, and SEBI auditors have accepted ion's outputs in 40+ engagements as of FY 2025–26.

Typical timeline:

• Day 1–3 · Read-only role provisioning across AWS, Azure, GCP, Kubernetes, identity providers
• Week 1 · First posture baseline complete; gap report against your named frameworks
• Week 2–3 · Custom framework mappings tuned to your regulator obligations (e.g. RBI specifics, SEBI category)
• Week 4 · First continuous evidence stream live; integration with your SIEM, ticketing, and reporting pipelines

Full-deployment-to-first-audit-readiness sits at ~30 days for most enterprises. SDFs and listed entities sometimes extend to 60 days for tuning their reporting templates.